GitHub Advisoryadvisory · Packagist

GHSA-x53v-v9xp-gf6g MantisBT XSS via move_attachments_page.php

MEDIUM Published 2022-05-17 Modified 2025-06-11 Official page ↗
Aliases
CVE-2017-7241
Ecosystem
Packagist
Packages
mantisbt/mantisbt
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-06-11

Affected packages

• Packagist mantisbt/mantisbt: < 1.3.9 → fixed in 1.3.9 • Packagist mantisbt/mantisbt: >= 2.0.0, < 2.1.3 → fixed in 2.1.3 • Packagist mantisbt/mantisbt: >= 2.2.0, < 2.2.3 → fixed in 2.2.3

Description

A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.

Related

Alias · CVE (1)

  • CVE-2017-7241 A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References